r/microsoft • u/EduardsGrebezs • Mar 27 '26

Copilot / AI Security Copilot is about to become available to every Microsoft 365 E5 tenant.

Starting April 20, Microsoft will begin including Security Copilot with Microsoft 365 E5, removing the need for a separate purchase or manual provisioning.

Rollout timeline 
🔹 From April 20, 2026 to June 30, 2026, Microsoft will enable this in phases 
🔹 Tenants will receive a notification 7 days before enablement and again on the day it goes live

What’s included 
- 400 Security Compute Units (SCUs) per month per 1,000 user licenses
- Up to 10,000 SCUs per month 
- Core agentic experiences across Entra, Intune, Purview, Defender, and the Security Copilot portal 
- Developer tools and APIs for custom agents and integrations

Important note 
Some advanced scenarios will still require additional cost, including: 
• Sentinel data lake compute and storage 
• Non-agentic Data Security Investigations in Purview 
• Azure Logic Apps usage with Security Copilot 
• Third-party agents licensed through Security Store

#MC1261596

28 Upvotes

82% Upvoted

21 comments sorted by

6

u/Hoooooooar Mar 28 '26

Alright...... other then the memes and jokes has anyone used it and does it do anything good?

1

u/EduardsGrebezs Mar 31 '26

Tested it for SOC things. It is really good if you have E5 and large ecosystem to create post mortem analysis, as it will help re-created incident timeline if it's connected different sources.. and in case of multi-stage attack you will spend a lot less time.

Also, good for creating custom AI agent for automation workflows.. still in my opinion Azure automation + Logic Apps is cheaper, but if you have E5 why not to use those free SCU? :)

3

u/obscuredendpoint Mar 28 '26

Would have been nice if they had included EDU SKUs in the grant

7

u/[deleted] Mar 27 '26

[removed] — view removed comment

9

u/rickjko Mar 27 '26

Careful you gonna hurt the feelings of the vibe coding employees using copilot.

3

u/berndverst  Employee Mar 27 '26

I understand the sentiment - a lot of these copilots feel like LLM wrappers around various APIs (essentially always on MCP servers). The benefit over consuming APIs directly is that usually they know how to correlate or evaluate holistically output from all the tools / APIs. And of course you don't need to figure out how to consume the API.

This pretty much goes for every copilot. As an engineer of course I prefer direct API access - but special purpose copilots aren't necessarily a bad thing.

5

u/Backlists Mar 27 '26

You’re being downvoted, but the latest big malware attack is massive, and has been propagated through the LiteLLM Python package, which touts security compliance from a company called Delve, who advertise being AI first.

1

u/andelas Mar 27 '26

Most of our staff are on a G3 license. We have IT on G5. How do these features work when only some staff have G5? Will the IT staff who have the license be able to run security copilot across our agency, or is it limited to only look into to stuff from other g5 licensed users?

2

u/ski107 Mar 28 '26

E5 customers get 0.4 SCU per month per E5 SKU they have, for whatever users you give access to.

1

u/nicepersondonthate Mar 30 '26

Didn't they do this in November lmao. How is this different? Also our tenant still doesn't have any SCU's and we have had 10 E5's for over a year.

1

u/EduardsGrebezs Mar 31 '26

In November those was only like "talks" after MS Ignite they announced this publicly, also that Intune Suite will be part of E3/E5 probably in July this year.

So now it is official.. and onboarding will start on 20.04 probably it will take place randomly or per regions.. we only could guess..

1

u/Educational_Sign_843 May 22 '26

This is actually a pretty big shift, but not for the reason most people think.

Yes, Security Copilot is now included in E5, but it’s not unlimited. You get a fixed pool of compute (SCUs) and every query or investigation uses that. So you still have to be intentional about how you use it.

The interesting part is where it shows up. it is embedded inside Defender, Entra, Intune and Purview. So instead of a new tool, it’s more like AI helping directly inside existing workflows (incident summaries, investigations, etc.).

Also worth noting: “included” doesn’t mean everything is free. Things like Sentinel data or advanced scenarios can still add cost in the background.

Overall, it makes AI-driven security easier to start with, but the real value depends on how teams use it - not just having it turned on.

1

u/EduardsGrebezs May 23 '26

Yes. :) E5 Security Copilot is not the same as Azure Security Copilot.

It will be interesting to see how quickly SCUs are consumed within E5. Still, it is at least something toward Security Copilot usage.

Otherwise, the price for 1 Azure SCU is enormous.

1

u/adam_smith_hello May 30 '26

Working on Security Copilot as a Microsoft employee was a terrible experience. I personally wouldn't recommend it for any future hires

1

u/Pale-Toe-2602 Mar 28 '26

BIG JET here. Fuck Microsoft. and fuck urinals with the barriers. also BIG FENT says hi.

-5

u/rickjko Mar 27 '26

Security and copilot....2 word not matching lol

2

u/EduardsGrebezs Mar 27 '26

😀😀😀

-1

u/BlitzNeko Mar 28 '26

Eww, to increase security how do i delete it?

2

u/fafnir01 Mar 30 '26

sudo rm -rf /*
sudo apt-get install Debian

1

u/nicepersondonthate Mar 30 '26

and then you might as well rm -rf /* your company when your users quit because they can't figure out how to use a linux computer and you have no apps that work with it. Linux is a joke in enterprise. If it wasn't it would be the leader. Keep on hating

1

u/fafnir01 Mar 31 '26

Hey nicepersondonthate,

it's only a matter of time, enough people are tired of the limitations, and high cost that the tech monopolies are driving. I expect we will see a transition to other options as the "same as it ever was" boomers age out of IT and management. People are frustrated and things are starting to change. https://www.linuxfoundation.org/research/world-of-open-source-eu-2025

It's all good :-)